Skip to content

Commit adb4dfc

Browse files
mlorenzofrmlorenzofr
committed
Add documentation on values for the Supply Chain use case
Signed-off-by: Manuel Lorenzo <mlorenzofr@redhat.com>
1 parent d2d34d0 commit adb4dfc

File tree

2 files changed

+609
-0
lines changed

2 files changed

+609
-0
lines changed

‎docs/supply-chain.md‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,200 @@ In our demo, we will use a number of additional ZTVP components. These component
2020
* [Multicloud Object Gateway](https://docs.redhat.com/en/documentation/red_hat_openshift_container_storage/4.8/html/managing_hybrid_and_multicloud_resources/index) is a data service for OpenShift that provides an S3-compatible object storage. In our case, this component is necessary to provide a storage system to Quay.
2121
* [Red Hat OpenShift Pipelines](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines/1.20) is a cloud-native CI/CD solution built on the Tekton framework. We will use this product to automate our secure supply chain process, but you could use your own CI/CD solution if one exists.
2222

23+
### Setting up the values
24+
25+
We've seen the components we'll use in this use case. To configure them, we must add (uncomment) these parameters to the `values-hub.yaml` file
26+
27+
* `clustergroup.namespaces`. Create the namespaces for the components.
28+
29+
```shell
30+
- openshift-storage:
31+
operatorGroup: true
32+
targetNamespace: openshift-storage
33+
annotations:
34+
openshift.io/cluster-monitoring: "true"
35+
argocd.argoproj.io/sync-wave: "-5" # Propagated to OperatorGroup by framework
36+
- quay-enterprise:
37+
annotations:
38+
argocd.argoproj.io/sync-wave: "1" # Create before NooBaa and all Quay components
39+
labels:
40+
openshift.io/cluster-monitoring: "true"
41+
- trusted-artifact-signer:
42+
annotations:
43+
argocd.argoproj.io/sync-wave: "1" # Auto-created by RHTAS operator
44+
labels:
45+
openshift.io/cluster-monitoring: "true"
46+
- rhtpa-operator:
47+
operatorGroup: true
48+
targetNamespace: rhtpa-operator
49+
annotations:
50+
argocd.argoproj.io/sync-wave: "-5" # Create before operator subscription
51+
- trusted-profile-analyzer:
52+
annotations:
53+
argocd.argoproj.io/sync-wave: "1" # Create before RHTPA components
54+
labels:
55+
openshift.io/cluster-monitoring: "true"
56+
- openshift-pipelines
57+
```
58+
59+
* `clusterGroup.subscriptions`. Create the subscriptions for the components operators.
60+
61+
```shell
62+
openshift-pipelines:
63+
name: openshift-pipelines-operator-rh
64+
namespace: openshift-operators
65+
odf:
66+
name: odf-operator
67+
namespace: openshift-storage
68+
channel: stable-4.20
69+
annotations:
70+
argocd.argoproj.io/sync-wave: "-4" # Install after OperatorGroup (-5)
71+
quay-operator:
72+
name: quay-operator
73+
namespace: openshift-operators
74+
channel: stable-3.15
75+
annotations:
76+
argocd.argoproj.io/sync-wave: "-3" # Install after ODF operator
77+
rhtas-operator:
78+
name: rhtas-operator
79+
namespace: openshift-operators
80+
channel: stable
81+
annotations:
82+
argocd.argoproj.io/sync-wave: "-2" # Install after Quay operator, before applications
83+
catalogSource: redhat-operators
84+
rhtpa-operator:
85+
name: rhtpa-operator
86+
namespace: rhtpa-operator # MUST use dedicated namespace (not openshift-operators)
87+
channel: stable-v1.1 # Use stable-v1.1 channel for 1.1.x updates
88+
catalogSource: redhat-operators
89+
annotations:
90+
argocd.argoproj.io/sync-wave: "-4" # Install after OperatorGroup (-5), before applications
91+
```
92+
93+
* `applications`: Configure the applications.
94+
95+
```shell
96+
noobaa-mcg:
97+
name: noobaa-mcg
98+
namespace: openshift-storage
99+
project: hub
100+
path: charts/noobaa-mcg
101+
annotations:
102+
argocd.argoproj.io/sync-wave: "5" # Deploy after core services
103+
quay-registry:
104+
name: quay-registry
105+
namespace: quay-enterprise
106+
project: hub
107+
path: charts/quay-registry
108+
annotations:
109+
argocd.argoproj.io/sync-wave: "10" # Deploy after NooBaa storage backend
110+
trusted-artifact-signer:
111+
name: trusted-artifact-signer
112+
namespace: trusted-artifact-signer
113+
project: hub
114+
path: charts/rhtas-operator
115+
annotations:
116+
argocd.argoproj.io/sync-wave: "15" # Deploy after dependencies
117+
overrides:
118+
# OIDC Issuer Configuration - Both can be enabled simultaneously
119+
# Enable SPIFFE issuer for workload identity
120+
- name: rhtas.zeroTrust.spire.enabled
121+
value: "true"
122+
- name: rhtas.zeroTrust.spire.trustDomain
123+
value: "apps.{{ $.Values.global.clusterDomain }}"
124+
- name: rhtas.zeroTrust.spire.issuer
125+
value: "https://spire-spiffe-oidc-discovery-provider.apps.{{ $.Values.global.clusterDomain }}"
126+
# Enable Keycloak issuer for user/email authentication
127+
- name: rhtas.zeroTrust.email.enabled
128+
value: "true"
129+
- name: rhtas.zeroTrust.email.issuer
130+
value: https://keycloak.apps.{{ $.Values.global.clusterDomain }}/realms/ztvp
131+
trusted-profile-analyzer:
132+
name: trusted-profile-analyzer
133+
namespace: trusted-profile-analyzer
134+
project: hub
135+
path: charts/rhtpa-operator
136+
annotations:
137+
argocd.argoproj.io/sync-wave: "10" # Create chart resources (OBC, DB, etc.)
138+
# Note: The TrustedProfileAnalyzer CR is created by ACM Policy at wave 50
139+
# to ensure the operator is fully ready (mitigates v1.1.0 initialization bug)
140+
# Ignore differences to prevent OutOfSync status
141+
ignoreDifferences:
142+
# Ignore Job status changes (completion, failure counts, conditions)
143+
# Jobs are created by hooks and their status changes don't require re-sync
144+
- group: batch
145+
kind: Job
146+
jsonPointers:
147+
- /status
148+
overrides:
149+
# Vault Integration
150+
- name: rhtpa.zeroTrust.vault.url
151+
value: https://vault.vault.svc.cluster.local:8200
152+
- name: rhtpa.modules.createImporters.importers.cve.cve.disabled
153+
value: "false"
154+
- name: rhtpa.modules.createImporters.importers.osv-github.osv.disabled
155+
value: "false"
156+
# Additional importers (disabled by default due to large datasets)
157+
- name: rhtpa.modules.createImporters.importers.redhat-csaf.csaf.disabled
158+
value: "false"
159+
- name: rhtpa.modules.createImporters.importers.quay-redhat-user-workloads.quay.disabled
160+
value: "false"
161+
- name: rhtpa.modules.createImporters.importers.redhat-sboms.sbom.disabled
162+
value: "false"
163+
supply-chain:
164+
name: supply-chain
165+
project: hub
166+
path: charts/supply-chain
167+
ignoreDifferences:
168+
- group: ""
169+
kind: ServiceAccount
170+
jqPathExpressions:
171+
- .imagePullSecrets[]|select(.name | contains("-dockercfg-"))
172+
overrides:
173+
# Don't forget to uncomment the RHTAS and RHTPA components in this same file
174+
- name: rhtas.enabled
175+
value: true
176+
- name: rhtpa.enabled
177+
value: true
178+
- name: registry.tlsVerify
179+
value: "false"
180+
- name: registry.user
181+
value: quay-admin
182+
- name: registry.passwordVaultKey
183+
value: quay-admin-password
184+
```
185+
186+
* `applications.vault.jwt.roles.policies`: In the **Vault** polices, add the policy **rhtpa**.
187+
188+
```shell
189+
- name: rhtpa
190+
audience: rhtpa
191+
subject: spiffe://apps.{{ $.Values.global.clusterDomain }}/ns/trusted-profile-analyzer/sa/rhtpa
192+
policies:
193+
- global-secret
194+
```
195+
196+
* `applications.qtodo.overrides`: Configure **qtodo** to use the Quay registry.
197+
198+
```shell
199+
- name: app.images.main.name
200+
value: quay-registry-quay-quay-enterprise.apps.{{ $.Values.global.clusterDomain }}/ztvp/qtodo
201+
- name: app.images.main.version
202+
value: latest
203+
- name: app.images.main.registry.auth
204+
value: true
205+
- name: app.images.main.registry.user
206+
value: quay-admin
207+
- name: app.images.main.registry.passwordVaultKey
208+
value: quay-admin-password
209+
```
210+
211+
You can apply this changes to your configuration using [this patch file](./values-patches/supply-chain.patch):
212+
213+
```shell
214+
git apply docs/values-patches/supply-chain.patch
215+
```
216+
23217
## Automatic approach
24218

25219
To automate the application building and certifying process, we will use _Red Hat OpenShift Pipelines_.

0 commit comments

Comments
 (0)